On 14 June 2023 the European Parliament adopted its position on the draft AI Act, bringing an EU regulation for generative AI and other AI systems one step closer.
A (draft) AI Act?
In April 2021 the EU legislator published a first draft of the so-called ‘AI Act’. Its aim is to create a harmonised set of rules for the development, placing on the market and use of AI in the European Union, so that AI systems are used safely, ethically and reliably while people’s rights are protected.
Since then, the text has been amended and debated at length. In particular, the recent widespread roll-out of ChatGPT, and the attention paid to such ‘general-purpose AI systems’, prompted the insertion of substantial clarifications and obligations for the providers of those systems.
Because the AI Act is a regulation, it will be binding in its entirety and directly applicable in all Member States.
What are the main components of the draft AI Act?
At the heart of the AI Act lies a risk-based approach, built on six quality principles:
-human agency and oversight
-technical robustness and safety
-privacy and data governance
-transparency
-diversity, non-discrimination and fairness
-social and environmental well-being
These principles are then turned into specific obligations. Which obligations an entity must meet will depend on (a) the nature of the entity and (b) the AI system concerned.
a. Who does the draft AI Act apply to?
The AI Act will apply first and foremost to providers placing AI systems on the EU market. As with the GDPR, an entity need not be established in the EU to fall within the scope of the AI Act, so US or Chinese companies may also be subject to it. Manufacturers, authorised representatives, distributors and importers will also have to comply with certain obligations.
b. What are the different categories of AI system and their obligations?
Below is a brief summary of the key points for each category of AI system set out in the draft:
• AI systems posing an unacceptable risk
Placing such AI systems on the EU market is prohibited across the board, as they are considered contrary to the Union’s values of respect for human dignity and fundamental rights.
-Social scoring (classifying people on the basis of their social behaviour or personal characteristics);
-emotion recognition systems in law enforcement, the workplace or educational institutions;
-‘real-time’ remote biometric identification systems in publicly accessible spaces.
• High-risk AI systems
This is the most strictly regulated category. It covers AI systems that entail significant harm to people’s health, safety or fundamental rights, or to the environment.
The AI Act imposes very extensive requirements that these AI systems must meet, as well as far-reaching obligations on providers wishing to place them on the market. These include implementing a quality management system, carrying out a conformity assessment (CE marking), conducting a ‘fundamental rights impact assessment’, training and data governance, and cybersecurity.
-AI systems used to operate critical infrastructure (for example, the electricity supply);
-Automated hiring tools;
-Credit scoring;
-AI recommender systems used by social media platforms designated as very large online platforms under the Digital Services Act (DSA).
• General-purpose AI systems
These are AI systems designed to perform a wide range of tasks and applied broadly across different domains. They can perform functions such as recognising and understanding images and speech, generating audio and video content, detecting patterns, answering questions, translating languages and more.
This category was introduced only recently and also covers generative AI (e.g. ChatGPT) and ‘foundation models’ (e.g. GPT-3.5). A tiered approach is proposed for these models, with a stricter regime for foundation models.
The obligations include carrying out risk assessments; requirements relating to the design of the foundation model (including from an environmental-impact perspective); registering the foundation model in an EU database; notifying people that they are interacting with an AI system; and making available a summary of the training data protected under copyright law.
-Chatbots;
-Translation tools;
-Virtual assistants.
All other AI systems
In principle, all AI systems must provide users with certain information to ensure transparency.
What about enforcement?
Enforcement will fall mainly to national supervisory authorities. They will have wide-ranging powers, including the power to impose fines (in amounts similar to those under the GDPR). Placing unacceptable AI systems on the market, however, may be punished with administrative fines of up to EUR 40,000,000 or, if the offender is a company, up to 7% of its total worldwide annual turnover for the preceding financial year, whichever is higher.
When will companies have to comply with the AI Act?
A final text is expected by the end of the year, and it will apply two years after that.
Boletim
Eventos, notícias e análises sobre direito digital, no seu e-mail. Só quando houver novidades.
